Attachment 171124 Details for Bug 210089 – experimental patch for sdpd

[patch] experimental patch for sdpd

patch-10-r301506-ssar.c (text/plain), 3.96 KB, created by Tatsuki Makino on 2016-06-07 07:54:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tatsuki Makino

Created: 2016-06-07 07:54:49 UTC

Size: 3.96 KB

patch

obsolete

>Index: usr.sbin/bluetooth/sdpd/ssar.c
>===================================================================
>--- usr.sbin/bluetooth/sdpd/ssar.c	(revision 301506)
>+++ usr.sbin/bluetooth/sdpd/ssar.c	(working copy)
>@@ -43,6 +43,171 @@
> 		uint8_t const *req, uint8_t const * const req_end,
> 		uint8_t *rsp, uint8_t const * const rsp_end);
> 
>+#include <stdlib.h>
>+static int
>+search_attr(provider_p const provider, const uint128_t *uuid)
>+{
>+	static const size_t bufsize = NG_L2CAP_MTU_MAXIMUM;
>+	static const int16_t attrs[] = {
>+		SDP_ATTR_PROTOCOL_DESCRIPTOR_LIST,
>+		SDP_ATTR_BLUETOOTH_PROFILE_DESCRIPTOR_LIST,
>+	};
>+	static const int attrs_len = sizeof(attrs) / sizeof(attrs[0]);
>+	uint8_t *buf, *pos, *lim, *mark;
>+	profile_attr_create_p cf;
>+	int i;
>+	int found = 0;
>+	int32_t type, len, value;
>+	int128_t duuid;
>+
>+	buf = (uint8_t *)calloc(bufsize, sizeof(*buf));
>+	if (buf == NULL) {
>+		found = 0;
>+		return found;
>+	}
>+
>+	for (i = 0; !found && i < attrs_len; ++i) {
>+		cf = profile_get_attr(provider->profile, attrs[i]);
>+		if (cf == NULL) {
>+			continue;
>+		}
>+
>+		lim = buf + bufsize;
>+		bzero(buf, bufsize * sizeof(*buf));
>+		len = (*cf)(buf, lim, (uint8_t const *)provider, sizeof(*provider));
>+		if (len < 0) {
>+			/* error */
>+			continue;
>+		}
>+
>+		pos = buf;
>+		lim = buf + len;
>+
>+		/* descriptor list length */
>+		if (pos + 1 > lim) {
>+			/* invalid */
>+			continue;
>+		}
>+		SDP_GET8(type, pos);
>+		if (type == SDP_DATA_SEQ8) {
>+			if (pos + 1 > lim) {
>+				/* invalid */
>+				continue;
>+			}
>+			SDP_GET8(len, pos);
>+		} else if (type == SDP_DATA_SEQ16) {
>+			if (pos + 2 > lim) {
>+				/* invalid */
>+				continue;
>+			}
>+			SDP_GET16(len, pos);
>+		} else if (type == SDP_DATA_SEQ32) {
>+			if (pos + 4 > lim) {
>+				/* invalid */
>+				continue;
>+			}
>+			SDP_GET32(len, pos);
>+		} else {
>+			/* error */
>+			continue;
>+		}
>+
>+		if (pos + len > lim) {
>+			/* invalid */
>+			continue;
>+		}
>+
>+		while (pos < lim) {
>+			/* descriptor length */
>+			if (pos + 1 > lim) {
>+				/* invalid */
>+				break;
>+			}
>+			SDP_GET8(type, pos);
>+			if (type == SDP_DATA_SEQ8) {
>+				if (pos + 1 > lim) {
>+					/* invalid */
>+					break;
>+				}
>+				SDP_GET8(len, pos);
>+			} else if (type == SDP_DATA_SEQ16) {
>+				if (pos + 2 > lim) {
>+					/* invalid */
>+					break;
>+				}
>+				SDP_GET16(len, pos);
>+			} else if (type == SDP_DATA_SEQ32) {
>+				if (pos + 4 > lim) {
>+					/* invalid */
>+					break;
>+				}
>+				SDP_GET32(len, pos);
>+			} else {
>+				/* error */
>+				break;
>+			}
>+
>+			if (pos + len > lim) {
>+				/* invalid */
>+				break;
>+			}
>+
>+			mark = pos;
>+
>+			/* uuid */
>+			if (pos + 1 > lim) {
>+				/* invalid */
>+				break;
>+			}
>+			SDP_GET8(type, pos);
>+			if (type == SDP_DATA_UUID16) {
>+				if (pos + 2 > lim) {
>+					/* invalid */
>+					break;
>+				}
>+				SDP_GET16(value, pos);
>+				memcpy(&duuid, &uuid_base, sizeof(duuid));
>+				duuid.b[2] = value >> 8 & 0xff;
>+				duuid.b[3] = value & 0xff;
>+			} else if (type == SDP_DATA_UUID32) {
>+				if (pos + 4 > lim) {
>+					/* invalid */
>+					break;
>+				}
>+				SDP_GET32(value, pos);
>+				memcpy(&duuid, &uuid_base, sizeof(duuid));
>+				duuid.b[0] = value >> 24 & 0xff;
>+				duuid.b[1] = value >> 16 & 0xff;
>+				duuid.b[2] = value >> 8 & 0xff;
>+				duuid.b[3] = value & 0xff;
>+			} else if (type == SDP_DATA_UUID128) {
>+				if (pos + 16 > lim) {
>+					/* invalid */
>+					break;
>+				}
>+				SDP_GET_UUID128(&duuid, pos);
>+			} else {
>+				/* error */
>+				break;
>+			}
>+
>+			if (memcmp(uuid, &duuid, sizeof(*uuid)) == 0) {
>+				found = 1;
>+				break;
>+			}
>+
>+			pos = mark + len;
>+		}
>+	}
>+
>+	if (buf != NULL) {
>+		free(buf);
>+		buf = NULL;
>+	}
>+
>+	return found;
>+}
>+
> /*
>  * Prepare SDP Service Search Attribute Response
>  */
>@@ -222,7 +387,8 @@
> 			puuid.b[3] = provider->profile->uuid;
> 
> 			if (memcmp(&uuid, &puuid, sizeof(uuid)) != 0 &&
>-			    memcmp(&uuid, &uuid_public_browse_group, sizeof(uuid)) != 0)
>+			    memcmp(&uuid, &uuid_public_browse_group, sizeof(uuid)) != 0 &&
>+			    search_attr(provider, &uuid) == 0)
> 				continue;
> 
> 			cs = server_prepare_attr_list(provider,

Actions: View | Diff

Attachments on bug 210089: 171124